Debian Linux vulnerabilities

CVE-2025-38601 [MEDIUM] CWE-909 CVE-2025-38601: In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: clear initialized In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: clear initialized flag for deinit-ed srng lists In a number of cases we see kernel panics on resume due to ath11k kernel page fault, which happens under the following circumstances: 1) First ath11k_hal_dump_srng_stats() call Last interrupt received for each group: a

CVE-2024-36939 [MEDIUM] CVE-2024-36939: In the Linux kernel, the following vulnerability has been resolved: nfs: Handle error of rpc_proc_r In the Linux kernel, the following vulnerability has been resolved: nfs: Handle error of rpc_proc_register() in nfs_net_init(). syzkaller reported a warning [0] triggered while destroying immature netns. rpc_proc_register() was called in init_nfs_fs(), but its error has been ignored since at least the initial commit 1da177e4c3f4 ("Linux-2.6.12-rc2"). Rec

CVE-2024-35893 [MEDIUM] CWE-908 CVE-2024-35893: In the Linux kernel, the following vulnerability has been resolved: net/sched: act_skbmod: prevent In the Linux kernel, the following vulnerability has been resolved: net/sched: act_skbmod: prevent kernel-infoleak syzbot found that tcf_skbmod_dump() was copying four bytes from kernel stack to user space [1]. The issue here is that 'struct tc_skbmod' has a four bytes hole. We need to clear the structure before filling fields. [1] BUG: KMSAN: ke

CVE-2024-35944 [MEDIUM] CVE-2024-35944: In the Linux kernel, the following vulnerability has been resolved: VMCI: Fix memcpy() run-time war In the Linux kernel, the following vulnerability has been resolved: VMCI: Fix memcpy() run-time warning in dg_dispatch_as_host() Syzkaller hit 'WARNING in dg_dispatch_as_host' bug. memcpy: detected field-spanning write (size 56) of single field "&dg_info->msg" at drivers/misc/vmw_vmci/vmci_datagram.c:237 (size 24) WARNING: CPU: 0 PID: 1555 at drivers/mis

CVE-2024-35822 [MEDIUM] CVE-2024-35822: In the Linux kernel, the following vulnerability has been resolved: usb: udc: remove warning when q In the Linux kernel, the following vulnerability has been resolved: usb: udc: remove warning when queue disabled ep It is possible trigger below warning message from mass storage function, WARNING: CPU: 6 PID: 3839 at drivers/usb/gadget/udc/core.c:294 usb_ep_queue+0x7c/0x104 pc : usb_ep_queue+0x7c/0x104 lr : fsg_main_thread+0x494/0x1b3c Root cause is mas

CVE-2024-35825 [MEDIUM] CVE-2024-35825: In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ncm: Fix handling In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ncm: Fix handling of zero block length packets While connecting to a Linux host with CDC_NCM_NTB_DEF_SIZE_TX set to 65536, it has been observed that we receive short packets, which come at interval of 5-10 seconds sometimes and have block length zero but still contain 1-2 valid

CVE-2023-52635 [MEDIUM] CWE-835 CVE-2023-52635: In the Linux kernel, the following vulnerability has been resolved: PM / devfreq: Synchronize devfr In the Linux kernel, the following vulnerability has been resolved: PM / devfreq: Synchronize devfreq_monitor_[start/stop] There is a chance if a frequent switch of the governor done in a loop result in timer list corruption where timer cancel being done from two place one from cancel_delayed_work_sync() and followed by expire_timers() can be seen

CVE-2025-38174 [MEDIUM] CVE-2025-38174: In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Do not double dequ In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Do not double dequeue a configuration request Some of our devices crash in tb_cfg_request_dequeue(): general protection fault, probably for non-canonical address 0xdead000000000122 CPU: 6 PID: 91007 Comm: kworker/6:2 Tainted: G U W 6.6.65 RIP: 0010:tb_cfg_request_dequeue+0x2

CVE-2024-26835 [MEDIUM] CVE-2024-26835: In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: set dorma In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: set dormant flag on hook register failure We need to set the dormant flag again if we fail to register the hooks. During memory pressure hook registration can fail and we end up with a table marked as active but no registered hooks. On table/base chain deletion, nf_

CVE-2024-35796 [MEDIUM] CWE-476 CVE-2024-35796: In the Linux kernel, the following vulnerability has been resolved: net: ll_temac: platform_get_res In the Linux kernel, the following vulnerability has been resolved: net: ll_temac: platform_get_resource replaced by wrong function The function platform_get_resource was replaced with devm_platform_ioremap_resource_byname and is called using 0 as name. This eventually ends up in platform_get_resource_byname in the call stack, where it causes a nu

CVE-2024-35902 [MEDIUM] CWE-476 CVE-2024-35902: In the Linux kernel, the following vulnerability has been resolved: net/rds: fix possible cp null d In the Linux kernel, the following vulnerability has been resolved: net/rds: fix possible cp null dereference cp might be null, calling cp->cp_conn would produce null dereference [Simon Horman adds:] Analysis: * cp is a parameter of __rds_rdma_map and is not reassigned. * The following call-sites pass a NULL cp argument to __rds_rdma_map() - r

CVE-2025-23159 [MEDIUM] CWE-787 CVE-2025-23159: In the Linux kernel, the following vulnerability has been resolved: media: venus: hfi: add a check In the Linux kernel, the following vulnerability has been resolved: media: venus: hfi: add a check to handle OOB in sfr region sfr->buf_size is in shared memory and can be modified by malicious user. OOB write is possible when the size is made higher than actual sfr data buffer. Cap the size to allocated size for such cases.

CVE-2022-42328 [MEDIUM] CWE-667 CVE-2022-42328: Guests can trigger deadlock in Linux netback driver T[his CNA information record relates to multiple Guests can trigger deadlock in Linux netback driver T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] The patch for XSA-392 introduced another issue which might result in a deadlock when trying to free the SKB of a packet dropped due to the XSA-392 handling (CVE-2022-4232

CVE-2024-27004 [MEDIUM] CWE-667 CVE-2024-27004: In the Linux kernel, the following vulnerability has been resolved: clk: Get runtime PM before walk In the Linux kernel, the following vulnerability has been resolved: clk: Get runtime PM before walking tree during disable_unused Doug reported [1] the following hung task: INFO: task swapper/0:1 blocked for more than 122 seconds. Not tainted 5.15.149-21875-gf795ebc40eb8 #1 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.

CVE-2022-42329 [MEDIUM] CVE-2022-42329: Guests can trigger deadlock in Linux netback driver T[his CNA information record relates to multiple Guests can trigger deadlock in Linux netback driver T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] The patch for XSA-392 introduced another issue which might result in a deadlock when trying to free the SKB of a packet dropped due to the XSA-392 handling (CVE-2022-42328). Addi

CVE-2025-23150 [MEDIUM] CWE-193 CVE-2025-23150: In the Linux kernel, the following vulnerability has been resolved: ext4: fix off-by-one error in d In the Linux kernel, the following vulnerability has been resolved: ext4: fix off-by-one error in do_split Syzkaller detected a use-after-free issue in ext4_insert_dentry that was caused by out-of-bounds access due to incorrect splitting in do_split. BUG: KASAN: use-after-free in ext4_insert_dentry+0x36a/0x6d0 fs/ext4/namei.c:2109 Write of size 25

CVE-2024-26984 [MEDIUM] CWE-362 CVE-2024-26984: In the Linux kernel, the following vulnerability has been resolved: nouveau: fix instmem race condi In the Linux kernel, the following vulnerability has been resolved: nouveau: fix instmem race condition around ptr stores Running a lot of VK CTS in parallel against nouveau, once every few hours you might see something like this crash. BUG: kernel NULL pointer dereference, address: 0000000000000008 PGD 8000000114e6e067 P4D 8000000114e6e067 PUD 10

CVE-2025-23147 [MEDIUM] CWE-476 CVE-2025-23147: In the Linux kernel, the following vulnerability has been resolved: i3c: Add NULL pointer check in In the Linux kernel, the following vulnerability has been resolved: i3c: Add NULL pointer check in i3c_master_queue_ibi() The I3C master driver may receive an IBI from a target device that has not been probed yet. In such cases, the master calls `i3c_master_queue_ibi()` to queue an IBI work task, leading to "Unable to handle kernel read from unreada

CVE-2025-39827 [MEDIUM] CVE-2025-39827: In the Linux kernel, the following vulnerability has been resolved: net: rose: include node referen In the Linux kernel, the following vulnerability has been resolved: net: rose: include node references in rose_neigh refcount Current implementation maintains two separate reference counting mechanisms: the 'count' field in struct rose_neigh tracks references from rose_node structures, while the 'use' field (now refcount_t) tracks references from rose_sock

CVE-2015-3219 [MEDIUM] CWE-79 CVE-2015-3219: Cross-site scripting (XSS) vulnerability in the Orchestration/Stack section in OpenStack Dashboard ( Cross-site scripting (XSS) vulnerability in the Orchestration/Stack section in OpenStack Dashboard (Horizon) 2014.2 before 2014.2.4 and 2015.1.x before 2015.1.1 allows remote attackers to inject arbitrary web script or HTML via the description parameter in a heat template, which is not properly handled in the help_text attribute in the Field class.